A flaw in the public flow build endpoint of Langflow allows an attacker to supply arbitrary Python code that is executed without any sandboxing. By posting malicious flow data to the endpoint, an unauthenticated actor can run code on the server with the privileges of the Langflow process, leading to full compromise of the host. The weakness involves unprotected execution of user-supplied code, a classic remote code execution scenario.

The vulnerability affects the Langflow application from langflow‑ai, specifically any deployment of versions earlier than 1.9.0. Clients that rely on the public flow build feature without enforcing authentication are at risk. Full vendor and product details locate the issue in the open source Langflow repository.

The CVSS score of 9.3 places the flaw in the high‑to‑critical band, and although the EPSS score is under 1%, the vulnerability is listed in the CISA KEV catalog, indicating known exploitation activity. Attackers can trigger the flaw by sending a crafted HTTP POST request to /api/v1/build_public_tmp/{flow_id}/flow, supplying flow data containing executable code. No authentication or additional conditions are required, making the exploit straightforward for an attacker with network access to the service.